Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
08/09/2024, 03:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e2769e9f4f8fcafecdf5eaaad09cbbb39ad7ce971716518db6e4590f1fa70e9e.exe
Resource
win7-20240903-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
e2769e9f4f8fcafecdf5eaaad09cbbb39ad7ce971716518db6e4590f1fa70e9e.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
e2769e9f4f8fcafecdf5eaaad09cbbb39ad7ce971716518db6e4590f1fa70e9e.exe
-
Size
49KB
-
MD5
6d77320a5454ca41861aedc3eea4a2b7
-
SHA1
9ed68188f0e8fe4954a255022db781740ef875f7
-
SHA256
e2769e9f4f8fcafecdf5eaaad09cbbb39ad7ce971716518db6e4590f1fa70e9e
-
SHA512
b7352dd355a68e7f694e8c290a4012fd8ee3a97c5eb5e53409ad30925ae0c8e06e9e4d787b6740f06e0ba89c2f4d026fe57b8e5b418ecf61cc2d0b3f31154408
-
SSDEEP
768:W7BlpppARFbhjbhg42LcfpR42LcfproFNFew/DbAGw/DbAXoVRO8iJfoVRO8iJp+:W7ZppApBULcfpHLcfpyDoAI9gRoRR
Score
9/10
Malware Config
Signatures
-
Renames multiple (529) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\DVD Maker\directshowtap.ax.tmp e2769e9f4f8fcafecdf5eaaad09cbbb39ad7ce971716518db6e4590f1fa70e9e.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_trans_rgb.wmv.tmp e2769e9f4f8fcafecdf5eaaad09cbbb39ad7ce971716518db6e4590f1fa70e9e.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\btn-next-static.png.tmp e2769e9f4f8fcafecdf5eaaad09cbbb39ad7ce971716518db6e4590f1fa70e9e.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\vi.pak.tmp e2769e9f4f8fcafecdf5eaaad09cbbb39ad7ce971716518db6e4590f1fa70e9e.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\jli.dll.tmp e2769e9f4f8fcafecdf5eaaad09cbbb39ad7ce971716518db6e4590f1fa70e9e.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Genko_2.emf.tmp e2769e9f4f8fcafecdf5eaaad09cbbb39ad7ce971716518db6e4590f1fa70e9e.exe File created C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\de-DE\MSTTSLoc.dll.mui.tmp e2769e9f4f8fcafecdf5eaaad09cbbb39ad7ce971716518db6e4590f1fa70e9e.exe File created C:\Program Files\Common Files\System\msadc\ja-JP\msadcor.dll.mui.tmp e2769e9f4f8fcafecdf5eaaad09cbbb39ad7ce971716518db6e4590f1fa70e9e.exe File created C:\Program Files\Common Files\System\msadc\msaddsr.dll.tmp e2769e9f4f8fcafecdf5eaaad09cbbb39ad7ce971716518db6e4590f1fa70e9e.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationRight_ButtonGraphic.png.tmp e2769e9f4f8fcafecdf5eaaad09cbbb39ad7ce971716518db6e4590f1fa70e9e.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\content-background.png.tmp e2769e9f4f8fcafecdf5eaaad09cbbb39ad7ce971716518db6e4590f1fa70e9e.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationRight_ButtonGraphic.png.tmp e2769e9f4f8fcafecdf5eaaad09cbbb39ad7ce971716518db6e4590f1fa70e9e.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\npt.dll.tmp e2769e9f4f8fcafecdf5eaaad09cbbb39ad7ce971716518db6e4590f1fa70e9e.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\TipBand.dll.mui.tmp e2769e9f4f8fcafecdf5eaaad09cbbb39ad7ce971716518db6e4590f1fa70e9e.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\grid_(inch).wmf.tmp e2769e9f4f8fcafecdf5eaaad09cbbb39ad7ce971716518db6e4590f1fa70e9e.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Seyes.emf.tmp e2769e9f4f8fcafecdf5eaaad09cbbb39ad7ce971716518db6e4590f1fa70e9e.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\IPSEventLogMsg.dll.tmp e2769e9f4f8fcafecdf5eaaad09cbbb39ad7ce971716518db6e4590f1fa70e9e.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\tipresx.dll.mui.tmp e2769e9f4f8fcafecdf5eaaad09cbbb39ad7ce971716518db6e4590f1fa70e9e.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\720x480blacksquare.png.tmp e2769e9f4f8fcafecdf5eaaad09cbbb39ad7ce971716518db6e4590f1fa70e9e.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\203x8subpicture.png.tmp e2769e9f4f8fcafecdf5eaaad09cbbb39ad7ce971716518db6e4590f1fa70e9e.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\preloaded_data.pb.tmp e2769e9f4f8fcafecdf5eaaad09cbbb39ad7ce971716518db6e4590f1fa70e9e.exe File created C:\Program Files\7-Zip\Lang\en.ttt.tmp e2769e9f4f8fcafecdf5eaaad09cbbb39ad7ce971716518db6e4590f1fa70e9e.exe File created C:\Program Files\Common Files\Microsoft Shared\Filters\offfiltx.dll.tmp e2769e9f4f8fcafecdf5eaaad09cbbb39ad7ce971716518db6e4590f1fa70e9e.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\InputPersonalization.exe.mui.tmp e2769e9f4f8fcafecdf5eaaad09cbbb39ad7ce971716518db6e4590f1fa70e9e.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\en-US\IPSEventLogMsg.dll.mui.tmp e2769e9f4f8fcafecdf5eaaad09cbbb39ad7ce971716518db6e4590f1fa70e9e.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\mshwgst.dll.tmp e2769e9f4f8fcafecdf5eaaad09cbbb39ad7ce971716518db6e4590f1fa70e9e.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\travel.png.tmp e2769e9f4f8fcafecdf5eaaad09cbbb39ad7ce971716518db6e4590f1fa70e9e.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\el.pak.tmp e2769e9f4f8fcafecdf5eaaad09cbbb39ad7ce971716518db6e4590f1fa70e9e.exe File created C:\Program Files\Internet Explorer\en-US\F12.dll.mui.tmp e2769e9f4f8fcafecdf5eaaad09cbbb39ad7ce971716518db6e4590f1fa70e9e.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\w2k_lsa_auth.dll.tmp e2769e9f4f8fcafecdf5eaaad09cbbb39ad7ce971716518db6e4590f1fa70e9e.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\mshwLatin.dll.mui.tmp e2769e9f4f8fcafecdf5eaaad09cbbb39ad7ce971716518db6e4590f1fa70e9e.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\tipresx.dll.mui.tmp e2769e9f4f8fcafecdf5eaaad09cbbb39ad7ce971716518db6e4590f1fa70e9e.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\shadowonlyframe_videoinset.png.tmp e2769e9f4f8fcafecdf5eaaad09cbbb39ad7ce971716518db6e4590f1fa70e9e.exe File created C:\Program Files\Java\jdk1.7.0_80\include\classfile_constants.h.tmp e2769e9f4f8fcafecdf5eaaad09cbbb39ad7ce971716518db6e4590f1fa70e9e.exe File created C:\Program Files\7-Zip\Lang\az.txt.tmp e2769e9f4f8fcafecdf5eaaad09cbbb39ad7ce971716518db6e4590f1fa70e9e.exe File created C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\it-IT\MSTTSLoc.dll.mui.tmp e2769e9f4f8fcafecdf5eaaad09cbbb39ad7ce971716518db6e4590f1fa70e9e.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\passport.png.tmp e2769e9f4f8fcafecdf5eaaad09cbbb39ad7ce971716518db6e4590f1fa70e9e.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\af.pak.tmp e2769e9f4f8fcafecdf5eaaad09cbbb39ad7ce971716518db6e4590f1fa70e9e.exe File created C:\Program Files\7-Zip\Lang\hr.txt.tmp e2769e9f4f8fcafecdf5eaaad09cbbb39ad7ce971716518db6e4590f1fa70e9e.exe File created C:\Program Files\7-Zip\Lang\tk.txt.tmp e2769e9f4f8fcafecdf5eaaad09cbbb39ad7ce971716518db6e4590f1fa70e9e.exe File created C:\Program Files\Common Files\System\msadc\en-US\msadcor.dll.mui.tmp e2769e9f4f8fcafecdf5eaaad09cbbb39ad7ce971716518db6e4590f1fa70e9e.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\es-419.pak.tmp e2769e9f4f8fcafecdf5eaaad09cbbb39ad7ce971716518db6e4590f1fa70e9e.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\hi.pak.tmp e2769e9f4f8fcafecdf5eaaad09cbbb39ad7ce971716518db6e4590f1fa70e9e.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\Logo.png.tmp e2769e9f4f8fcafecdf5eaaad09cbbb39ad7ce971716518db6e4590f1fa70e9e.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\IpsMigrationPlugin.dll.mui.tmp e2769e9f4f8fcafecdf5eaaad09cbbb39ad7ce971716518db6e4590f1fa70e9e.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Perf_Scenes_Subpicture1.png.tmp e2769e9f4f8fcafecdf5eaaad09cbbb39ad7ce971716518db6e4590f1fa70e9e.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\106.0.5249.119.manifest.tmp e2769e9f4f8fcafecdf5eaaad09cbbb39ad7ce971716518db6e4590f1fa70e9e.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\mr.pak.tmp e2769e9f4f8fcafecdf5eaaad09cbbb39ad7ce971716518db6e4590f1fa70e9e.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe.tmp e2769e9f4f8fcafecdf5eaaad09cbbb39ad7ce971716518db6e4590f1fa70e9e.exe File created C:\Program Files\7-Zip\7-zip32.dll.tmp e2769e9f4f8fcafecdf5eaaad09cbbb39ad7ce971716518db6e4590f1fa70e9e.exe File created C:\Program Files\7-Zip\Lang\fy.txt.tmp e2769e9f4f8fcafecdf5eaaad09cbbb39ad7ce971716518db6e4590f1fa70e9e.exe File created C:\Program Files\Common Files\Microsoft Shared\Stationery\Cave_Drawings.gif.tmp e2769e9f4f8fcafecdf5eaaad09cbbb39ad7ce971716518db6e4590f1fa70e9e.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationRight_SelectionSubpicture.png.tmp e2769e9f4f8fcafecdf5eaaad09cbbb39ad7ce971716518db6e4590f1fa70e9e.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\he.pak.tmp e2769e9f4f8fcafecdf5eaaad09cbbb39ad7ce971716518db6e4590f1fa70e9e.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jdb.exe.tmp e2769e9f4f8fcafecdf5eaaad09cbbb39ad7ce971716518db6e4590f1fa70e9e.exe File created C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyrun.jar.tmp e2769e9f4f8fcafecdf5eaaad09cbbb39ad7ce971716518db6e4590f1fa70e9e.exe File created C:\Program Files\7-Zip\Lang\fa.txt.tmp e2769e9f4f8fcafecdf5eaaad09cbbb39ad7ce971716518db6e4590f1fa70e9e.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\background.png.tmp e2769e9f4f8fcafecdf5eaaad09cbbb39ad7ce971716518db6e4590f1fa70e9e.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\blackbars60.png.tmp e2769e9f4f8fcafecdf5eaaad09cbbb39ad7ce971716518db6e4590f1fa70e9e.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Memories_buttonClear.png.tmp e2769e9f4f8fcafecdf5eaaad09cbbb39ad7ce971716518db6e4590f1fa70e9e.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jsadebugd.exe.tmp e2769e9f4f8fcafecdf5eaaad09cbbb39ad7ce971716518db6e4590f1fa70e9e.exe File created C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_es.jar.tmp e2769e9f4f8fcafecdf5eaaad09cbbb39ad7ce971716518db6e4590f1fa70e9e.exe File created C:\Program Files\7-Zip\Lang\fi.txt.tmp e2769e9f4f8fcafecdf5eaaad09cbbb39ad7ce971716518db6e4590f1fa70e9e.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\IPSEventLogMsg.dll.mui.tmp e2769e9f4f8fcafecdf5eaaad09cbbb39ad7ce971716518db6e4590f1fa70e9e.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language e2769e9f4f8fcafecdf5eaaad09cbbb39ad7ce971716518db6e4590f1fa70e9e.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e2769e9f4f8fcafecdf5eaaad09cbbb39ad7ce971716518db6e4590f1fa70e9e.exe"C:\Users\Admin\AppData\Local\Temp\e2769e9f4f8fcafecdf5eaaad09cbbb39ad7ce971716518db6e4590f1fa70e9e.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2808
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
49KB
MD551d921610462383781488bf25fe9a6f4
SHA118ae2df6d7e67dca020faaf090b724474cf3b913
SHA2564b3d7f229a65dc6f32e02236701e5fcb595863b66ae5bdd063e67346af756b84
SHA5121ffa8ac89f774003d269e07269c248421b28edfc54537e6a6f5fa0273a7bc999b6e31980086a25ed65f5faa33e8c2c181a5525775ac03bd2d22fa437f688c9f8
-
Filesize
58KB
MD55c2e641d9e35fbcb0d58ecf733fe8838
SHA1829543cbf032b56b9cfe0065b2e3b698b9702d7b
SHA2569c33af26e173e49bb285ccada2d6a3c4dd1b7a4059e0c182a5320714ac99f46d
SHA5125de98087b4c7bfbfc171977550adff9e57b92c172821f8b0d0ec94e98ab9c7bc76a1f0e0a616b5256ed20ba8844c65a5f3c74f5d9a8f68dc3f051ee46cc7652d